Malicious PDF — malware analysis report

Static analysis result for SHA-256 a6e19988f2cb11b1…

MALICIOUS

PDF

51.7 KB Created: 2020-08-12 08:39:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e0a8da153cfd77d6aa1f89a8fc33307a SHA-1: 0a27d43d1f82be0025e954c412184ee2dcc5bb97 SHA-256: a6e19988f2cb11b1db7f0111cca14744d8591f5afa74171615534fedc2699fa8
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains numerous links, including one to a known malicious redirector at ttraff.ru. The document body, though heavily obfuscated, contains text suggesting a PDF to Word conversion tool, which is a common lure. The ML classifier strongly indicates maliciousness. The primary attack vector appears to be directing the user to the malicious redirector, which likely serves further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=ph%25E1%25BA%25A7n+m%25E1%25BB%2581m+chuy%25E1%25BB%2583n+%25C4%2591%25E1%25BB%2595i+pdf+h%25C3%25ACnh+%25E1%25BA%25A3nh+sang+word
    • http://files.surodhoni.com/uploads/1/3/0/7/130775506/bazetiziteri-redeworekotalu-mixijapaxiwapaw-xuniruwogipem.pdf
    • http://files.elicranor.com/uploads/1/3/1/3/131398507/makegexel.pdf
    • http://xovome.mondellis.com/uploads/1/3/2/6/132695278/zurojadixilo.pdf
    • http://files.circlevranchcamp.org/uploads/1/3/2/7/132710763/1684791.pdf
    • https://cdn.shopify.com/s/files/1/0435/1646/1211/files/42585613749.pdf
    • https://cdn.shopify.com/s/files/1/0437/3423/7333/files/pebapagaridulipugekuj.pdf
    • https://cdn.shopify.com/s/files/1/0433/7877/0076/files/worujadojimitiposoz.pdf
    • https://cdn.shopify.com/s/files/1/0437/4052/8792/files/ansys_help_download.pdf
    • https://cdn.shopify.com/s/files/1/0432/1722/3840/files/the_great_rat_hunt.pdf
    • https://cdn.shopify.com/s/files/1/0432/7958/1352/files/71497518484.pdf
    • https://cdn.shopify.com/s/files/1/0434/0498/4483/files/39872139827.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/gubiwunezekubukezo.pdf
    • https://cdn.shopify.com/s/files/1/0446/9391/3756/files/47382179112.pdf
    • https://cdn.shopify.com/s/files/1/0431/6656/4507/files/42107480821.pdf
    • https://cdn.shopify.com/s/files/1/0434/0360/8216/files/novorilexenuz.pdf
    • https://cdn.shopify.com/s/files/1/0431/6263/2346/files/13190782899.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000063f4.bin
9c147d8a58ef5e13e9f933cece72467c2cd00476aaaedaaf8d06dffab7a193da		 pdf-font-stream PDF embedded font (sfnt) at offset 0x63F4 7044 bytes
font_01_sfnt_off0000797a.bin
0c178778048b9bdcfdd182041abd8dc3c45c2b51c94f65577e1c71629b501693		 pdf-font-stream PDF embedded font (sfnt) at offset 0x797A 22176 bytes
font_02_sfnt_off0000a9a2.bin
93a19691d1eefba735b6ae1c1183140c153f855953d7e130b9640fe94c92d8c3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA9A2 16108 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.